Threat Research

Inside Astaroth’s New Spambot Component

Crowdstrike
Inside Astaroth’s New Spambot Component
Astaroth (aka Guildma) operators added a WhatsApp Web spambot in Q4 2025, shifting from email-based distribution to automated messaging that turns infected victims into unwilling propagators of the malware. The analysis shows strong code overlap with the Vareg (aka WATER SACI, Eternidade) spambot and confirms Brazil-focused targeting through contact filtering, Portuguese templates, and Brazil-specific technical checks. #Astaroth #Guildma #Vareg #WATER_SACI #Eternidade #WhatsAppWeb #Brazil

Keypoints

  • Astaroth operators introduced a previously unseen WhatsApp Web spambot component in Q4 2025.
  • The new capability shifts distribution away from traditional email spam toward trusted social messaging.
  • The spambot runs browser automation in headless mode and hides automation indicators from the victim.
  • Strong code overlap links the Astaroth spambot to Vareg (aka WATER SACI, Eternidade), another WhatsApp Web spam tool.
  • Multiple details indicate Brazil-focused targeting, including Brazil-only phone filtering and Portuguese-language spam content.
  • The malware reuses Astaroth’s existing encryption, obfuscation, and loader chain to deploy the spambot.
  • Defensive guidance includes monitoring WebDriver activity, headless browsers, and WPPConnect/WA-JS downloads.

MITRE Techniques

  • [T1059.001] PowerShell – Used to download the browser WebDriver based on the installed browser version (‘The spamming process begins with Astaroth downloading a browser WebDriver … via a PowerShell (PS) command’).
  • [T1218.009] System Binary Proxy Execution: Regsvr32 – Not explicitly mentioned in the article as used, no.
  • [T1105] Ingress Tool Transfer – Used to fetch the WebDriver, WPPConnect/WA-JS library, and payload ZIP files from remote sources (‘retrieves … via an HTTP GET request’, ‘downloads a copy of the JavaScript library’).
  • [T1027] Obfuscated Files or Information – Used multiple obfuscation layers including string obfuscation, Base64, AES encryption, and custom transformations (‘six-stage process’, ‘Base64-encoded and AES-encrypted configuration’).
  • [T1140] Deobfuscate/Decode Files or Information – Strings and configuration are decoded/decrypted before use (‘To decode strings’, ‘Once decrypted, the configuration yields a JSON structure’).
  • [T1204.002] User Execution: Malicious File – A downloader script delivered via LNK/JScript leads to execution of the infection chain (‘often a Windows shortcut (LNK) file running JScript code’).
  • [T1055] Process Injection – The article describes a DLL decrypted and executed in memory, consistent with in-memory execution (‘decodes and executes a Delphi-based loader DLL in memory’).
  • [T1123] Audio Capture – Not mentioned.
  • [T1090] Proxy – Not mentioned.
  • [T1056.001] Keylogging – Not mentioned.
  • [T1005] Data from Local System – The spambot reads the victim’s WhatsApp Web contact list and browser profile data (‘reads the victim’s WhatsApp Web contact list’, ‘cookies and credentials’).
  • [T1056.003] Web Portal Capture – Accesses and automates WhatsApp Web through a browser session (‘load WhatsApp Web’, ‘automate WhatsApp Web spam distribution’).
  • [T1132.001] Data Encoding: Standard Encoding – Uses Base64-encoded scripts, ZIP files, and configuration elements (‘Base64-decoded script’, ‘Base64-encoded ZIP file’).
  • [T1021] Remote Services – The malware uses WebDriver’s local HTTP REST API to control the browser session (‘acts as a local HTTP REST API server’, ‘communicating with this local server’).
  • [T1203] Exploitation for Client Execution – Not explicitly mentioned.

Indicators of Compromise

  • [SHA256 hashes] encrypted/decrypted payloads – c7c62303ee1a37fd7a6e2db9c590ba75c647bc4d22d7dca50cfa8879222ac9e1, ec43a17685e3a555c2eb5f0a2802e9e45d5a2a5d49a0803155acbd74d9ecdbd7, and other 1 item
  • [SHA256 hash] decrypted spambot binary – d89105c4d567a95f674ed6eac538e32e288b658a4222a3d52e284a77782af4d5
  • [Domains/URLs] installer and C2 infrastructure – stretar7[.]contabilfacil[.]sbs, graconxonjal[.]empresaeficiente[.]sbs, and 2 more domains
  • [Domains/URLs] Vareg C2 servers – https[:]//varegjopeaks[.]com/api, https[:]//docsmoonstudioclayworks[.]online/arquivoatualizado/gera.php
  • [File/Path artifacts] browser profile copy destination – C:UsersPublicTempChromeAuto_, User Data
  • [File names / scripts] detected component names from YARA – BaixarWAJS, ProcessarEnvio, ProcessarContatos, and 3 more strings
  • [Config/secret values] configuration integrity key and markers – TenHaVunf!@#2026, EF01
  • [Ports] WebDriver listening range – 31175, 39999

Read more: https://www.crowdstrike.com/en-us/blog/inside-astaroths-new-spambot-component/

SHARE THIS STORY

WhatsAppX (Twitter)TelegramBlueskyFacebookLinkedInThreadsEmailPrint